fix(auth): let a valid key always win over IP throttle

Fixes critical finding 1 from security review round 2, 2026-08-22:
identify checked the per-source-IP throttle BEFORE verifying the
presented key. This plugin runs behind a Kubernetes Service, and with
externalTrafficPolicy: Cluster (this operator's own deployment),
r.RemoteAddr is the node's own SNAT address shared by every external
caller reaching that node — not a per-tenant address. 20 failed requests
from anywhere on the internet sharing that node locked out all 10 live
users, including the admin dashboard's own poll.

- identify now verifies the key FIRST, unconditionally: a valid key
  always succeeds before any throttle state is read. Every failure path
  still records against the caller's IP, but throttling is now pure
  observability (bounding log volume and tracker memory), never
  enforcement — an attacker with no valid key already got 'false'
  either way, so nothing is lost against brute force.
- Replaces the per-source-IP tracker's backing store: the general-
  purpose memoryStore (limits.go) has no size cap and a full mutex-held
  sweep that scales with tracked-IP count (~83ms at 1M IPs). authFailureTracker
  is a bounded, two-generation, O(1)-rotation structure capped at
  2x50,000 entries (important finding 1).
- logAuthEvent now emits a distinct, separately rate-limited
  'auth throttle:' line the first time a source crosses the limit
  (important finding 5), and both the routine and throttle-engaged
  lines report how many events they suppressed since the last line
  actually written, so several distinct attacker IPs in one window no
  longer collapse into a single indistinguishable line (important
  finding 6).
- The success path no longer touches the throttle tracker's mutex at
  all (important finding 2).

logger_test.go

@@ -122,3 +122,61 @@ func TestLogAuthEvent_Success_NeverRateLimited(t *testing.T) {
 		t.Fatalf("auth-ok lines = %d, want 5 (success logging must never be rate-limited), output=%q", n, out)
 	}
 }
+
+// TestLogAuthEvent_ThrottleEngaged_DistinctLine proves logAuthEvent emits
+// a distinct "auth throttle:" line, not the routine "auth failed:" one,
+// once a source IP has crossed authFailureLimit (security review round
+// 2, 2026-08-22, important finding 5) — an operator seeing this line
+// knows a SOURCE, not just one request, needs attention.
+func TestLogAuthEvent_ThrottleEngaged_DistinctLine(t *testing.T) {
+	gw := newTestGatewayForLogger(t)
+	clock := &fakeClock{now: time.Unix(1_700_000_000, 0)}
+	gw.auth.nowFn = clock.Now
+
+	r := httptest.NewRequest("POST", "/v1/chat/completions", nil)
+	r.RemoteAddr = "203.0.113.9:1234"
+	for i := 0; i < authFailureLimit; i++ {
+		gw.auth.recordAuthFailure(clientIP(r))
+	}
+
+	out := captureStderr(t, func() {
+		gw.logAuthEvent(false, "", r)
+	})
+
+	if !strings.Contains(out, "auth throttle:") {
+		t.Errorf("want an 'auth throttle:' line once the IP has crossed the limit, got %q", out)
+	}
+	if strings.Contains(out, "auth failed:") {
+		t.Errorf("want the routine 'auth failed:' line suppressed in favor of the distinct throttle line, got %q", out)
+	}
+}
+
+// TestLogAuthEvent_Failure_SuppressedCountReported proves the routine
+// failure line's rate-limit gate reports how many events it suppressed
+// (security review round 2, 2026-08-22, important finding 6): a single
+// global gate would otherwise make several rapid failures within one
+// window indistinguishable from a single one — the next line actually
+// written must name how many were collapsed into it.
+func TestLogAuthEvent_Failure_SuppressedCountReported(t *testing.T) {
+	gw := newTestGatewayForLogger(t)
+	clock := &fakeClock{now: time.Unix(1_700_000_000, 0)}
+	gw.auth.nowFn = clock.Now
+
+	r := httptest.NewRequest("POST", "/v1/chat/completions", nil)
+	r.RemoteAddr = "203.0.113.9:1234"
+
+	captureStderr(t, func() {
+		gw.logAuthEvent(false, "", r) // logged (first call on a fresh gate)
+		gw.logAuthEvent(false, "", r) // suppressed #1
+		gw.logAuthEvent(false, "", r) // suppressed #2
+	})
+
+	clock.Advance(authFailureLogEvery + time.Second)
+	out := captureStderr(t, func() {
+		gw.logAuthEvent(false, "", r)
+	})
+
+	if !strings.Contains(out, "2 more suppressed since last log") {
+		t.Errorf("want the next line to report 2 suppressed events, got %q", out)
+	}
+}